KCSA Kubernetes Security Fundamentals Practice Question

A security auditor notices that a deployment running in the 'production' namespace is violating the Restricted Pod Security Standard because containers are running as root. How can you enforce compliance using Pod Security Admission?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Label the 'production' namespace with 'pod-security.kubernetes.io/enforce=restricted'.

Applying the 'pod-security.kubernetes.io/enforce: restricted' label to the namespace enforces the restricted Pod Security Standard for all newly created pods.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
Label the 'production' namespace with 'pod-security.kubernetes.io/enforce=restricted'.
Why this is correct
Namespace labels are the correct mechanism to configure the Pod Security Admission controller to enforce standards.
✗
Create a NetworkPolicy that blocks root user communication.
Why it's wrong here
NetworkPolicies control network traffic, not user IDs or process execution contexts.
✗
Enable the SecurityContextDeny legacy admission controller.
Why it's wrong here
SecurityContextDeny is deprecated/removed and replaced by Pod Security Standards and Admission.
✗
Update the kube-apiserver flags to globally block non-restricted pods without namespace labels.
Why it's wrong here
Pod Security Admission is configured primarily via namespace labels rather than global API server flags alone.

About these practice questions

This KCSA question is part of Courseiva's 320-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Written and reviewed by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

Last reviewed August 2026 · checked against the official CNCF / Linux Foundation exam blueprint

Ready to practise?

Put this into practice with a full scored session.

Start practice session

Timed practice sets

Short scored sets — answer, get feedback, read the explanation, move on.

Free KCSA Practice Test 1 — 30 Questions→KCSA Practice Exam 2 — 20 Questions→

Study by exam domain

Drill one exam section at a time instead of jumping between unrelated topics.

Kubernetes Security Fundamentals Compliance And Security Frameworks Overview OF Cloud Native Security

Practice by scenario

Pick a question style and work only that format until it feels routine.

Browse scenarios

Topic-level practice

One concept per page — questions, worked explanations, and a short concept guide.

Kubernetes Security Fundamentals practice questions Overview OF Cloud Native Security practice questions Kubernetes Threat Model practice questions

Where to go next

Kubernetes and Cloud Native Security Associate (KCSA, CNCF) (KCSA) exam guide All KCSA questions KCSA practice test

This KCSA practice question is part of Courseiva's free CNCF / Linux Foundation certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCSA exam.